363 matches found
CVE-2023-46454
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality...
Design/Logic Flaw
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality...
CVE-2023-46456: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality...
CVE-2023-46454: Improper Neutralization of Special Elements used in an OS Command
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality...
CVE-2023-46455
In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload functionality...
CVE-2023-46455
GL.iNet GL-AR300M routers on firmware 4.3.7 are affected by CVE-2023-46455 due to a path traversal in the OpenVPN client file upload, enabling arbitrary file writes. Evidence from multiple sources (NVD/NVD-derived entries, Red Hat, Nuclei template, and Exploit-DB) confirms an unauthenticated path...
CVE-2023-46456
GL.iNET GL-AR300M (firmware 3.216) is affected by CVE-2023-46456, where the OpenVPN client file upload functionality can be abused to inject arbitrary shell commands, leading to remote code execution per multiple sources. The vulnerability affects the OpenVPN client file upload path; no official ...
GL.iNet Unauthenticated Remote Command Execution via the logread module.
A command injection vulnerability exists in multiple GL.iNet network products, allowing an attacker to inject and execute arbitrary shell commands via JSON parameters at the glsystemlog and glcrashlog interface in the logread module. This exploit requires post-authentication using the Admin-Token...
CVE-2023-47464
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function...
CVE-2023-47463
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the glnassys authentication function...
CVE-2023-47463
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the glnassys authentication function...
Authentication flaw
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the glnassys authentication function...
Code injection
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function...
CVE-2023-47463
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the glnassys authentication function...
CVE-2023-47463: Improper Preservation of Permissions
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the glnassys authentication function...
CVE-2023-47463
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the glnassys authentication function...
CVE-2023-47464: Improper Limitation of a Pathname to a Restricted Directory
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function...
CVE-2023-47463
CVE-2023-47463 affects GL.iNet AX1800 routers (versions 4.0.0 up to 4.4.x; fixed in 4.5.0+). An insecure permissions flaw in the gl_nas_sys authentication function lets an unauthenticated remote attacker craft a script to achieve arbitrary code execution. Impact is rated CRITICAL (CVSS 3.1: AV:N/...
CVE-2023-47464
GL.iNet AX1800 firmware (versions 4.0.0 to 4.4.x) is affected by an insecure permissions vulnerability that permits a remote attacker to execute arbitrary code through the upload API function (upload file endpoint, with file and path parameters). Root cause is improper access control on the uploa...